CHRIS GARCIA v. TRUIST FINANCIAL CORPORATION (2026)

ORDER DENYING DEFENDANT'S MOTION TO DISMISS [DKT. NO. 13]

Before the Court is Defendant Truist Financial Corporation (“Truist”)'s Motion to Dismiss. Dkt. No. 13. For the reasons stated below, the Motion is DENIED.

I. Background

A. Factual Background 1

This case concerns a putative class action on behalf of all Truist account holders who have “accessed and used truist.com (the ‘Website’) to apply for a loan or credit card,” and have had their private and confidential information used in the loan application process disclosed to LinkedIn by Truist without their consent. See Compl. ¶¶ 1-5. The named Plaintiff is Chris Garcia. Id. ¶ 5. Garcia is a resident and citizen of Los Angeles. Id.

Plaintiff Chris Garcia seeks to represent the following Nationwide Class: “All natural persons in the United States who, during the class period, maintained a LinkedIn account and applied for a credit card or loan on the Website.” Id. ¶ 74. He also seeks to represent the following California Subclass: “All natural persons in the State of California who, during the class period, maintained a LinkedIn account and applied for a credit card or loan on the Website.” Id.

Defendant Truist is a North Carolina corporation with its principal place of business in Charlotte, North Carolina. Id. ¶ 6. Truist is a provider of financial products and services including bank accounts, credit cards, and loans, to individuals throughout the United States, including in California. Id.

On or around May 2025, Garcia applied for a LightStream unsecured loan through Truist's Website, using the same device and browser he used to access his LinkedIn account. Id. ¶ 5. Garcia alleges that during the loan application process, Truist required Garcia to provide private information related to his citizenship, housing status, and employment information. Id. And unbeknownst to Garcia, Truist disclosed his personally identifiable information (“PII”) to LinkedIn—including communications that contained Plaintiff's confidential, “nonpublic personal information” as defined by the Gramm-Leach-Bliley Act (“GLBA”) and California Financial Information Privacy Act (“CalFIPA”). Id. Neither Truist nor LinkedIn received Garcia's prior consent to the sharing of his private and protected information. Id. Truist disclosed this information via a “LinkedIn Insight Tag,” on its Website, which is a type of code added to the website that tracks a user's engagement when using the website to obtain information about the website's visitors for marketing purposes. See id. ¶¶ 29-45, 54-69. The LinkedIn Insight Tag provides LinkedIn with information about the user's actions on the Website for any user who has signed into LinkedIn (even if the user subsequently logs out). Id. ¶ 42. Garcia alleges that he and the class have a reasonable expectation of privacy in the PII disclosed to Truist, and Truist invaded their privacy by disclosing such information to LinkedIn. See id. ¶¶ 3, 71-73.

B. Procedural History

On June 24, 2025, Plaintiff Chris Garcia filed a class action complaint in the Central District of California against Truist, alleging a claim of a violation of the Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. § 2511, et seq. for the entire class, and alleging three claims of (1) violation of the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code § 631(a); (2) violation of the CIPA, Cal. Penal Code § 632; and (3) invasion of privacy under California's constitution for the California Subclass. See id.

On August 15, 2025, Defendant Truist filed a Motion to Dismiss. Dkt. No. 13 (“Motion”). On August 19, 2025, the Court issued an Order granting the stipulation to a briefing schedule for this Motion. Dkt. No. 17. On September 12, 2025, Plaintiff filed an opposition. Dkt. No. 18 (“Opposition”). On September 25, 2025, Truist filed a reply. Dkt. No. 19 (“Reply”). The Court held a hearing on the Motion on February 4, 2026. Dkt. No. 26.

II. Legal Standard

A. 12(b)(1) Motion

Federal Rule of Civil Procedure 12(b)(1) authorizes a party to seek dismissal of an action for lack of subject-matter jurisdiction. “Because standing and ripeness pertain to federal courts' subject matter jurisdiction, they are properly raised in a Rule 12(b)(1) motion to dismiss.” Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1122 (9th Cir. 2010). In the context of a 12(b)(1) motion, the plaintiff bears the burden of establishing Article III standing to assert the claims. Id.

Rule 12(b)(1) jurisdictional challenges can be either facial or factual. Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). When a motion to dismiss attacks subject-matter jurisdiction on the face of the complaint, the court assumes the factual allegations in the complaint are true and draws all reasonable inferences in the plaintiff's favor. Doe v. Holy See, 557 F.3d 1066, 1073 (9th Cir. 2009). Moreover, the standards set forth in Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007), and Ashcroft v. Iqbal, 556 U.S. 662 (2009), apply with equal force to Article III standing when it is being challenged on the face of the complaint. See Terenkian v. Republic of Iraq, 694 F.3d 1122, 1131 (9th Cir. 2012) (applying Iqbal). Thus, in terms of Article III standing, the complaint must allege “sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ ” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 570).

To have Article III standing, the plaintiff must demonstrate that (1) it has suffered an injury in fact that is (a) concrete and particularized, (b) actual or imminent, not conjectural or hypothetical, (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision. Friends of the Earth v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180-81 (2000).

For an injury to be “particularized,” it “must affect the plaintiff in a personal and individual way.” Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016) (internal quotation marks omitted). “Article III standing requires a concrete injury even in the context of a statutory violation.” Id. at 331. The “creation of a statutory prohibition or obligation and a cause of action does not relieve courts of their responsibility to independently decide whether a plaintiff has suffered a concrete harm under Article III.” TransUnion LLC v. Ramirez, 594 U.S. 413, 426 (2021).

A “concrete” injury must be “ ‘de facto’; that is, it must actually exist. Spokeo, 578 U.S. at 340. To determine a concrete harm, courts should assess “whether plaintiffs have identified a close historical or common-law analogue for their asserted injury.” TransUnion, 594 U.S. at 424. This “does not require an exact duplicate in American history and tradition.” Id. And the harm need not be tangible; certain intangible harms, such as disclosure of private information, “can also be concrete.” Id. “Only those plaintiffs who have been concretely harmed by a defendant's statutory violation may sue that private defendant over that violation in federal court.” Id. at 427. “TransUnion contemplates a standing inquiry particularized to a plaintiff's circumstances and benchmarked to a specific tort.” Popa v. Microsoft Corp., 153 F.4th 784, 791 (9th Cir. 2025).

A plaintiff “must demonstrate standing for each claim that they press and for each form of relief that they seek (for example, injunctive relief and damages).” TransUnion, 594 U.S. at 431. In the class action context, “a class action plaintiff must ‘allege a distinct and palpable injury to himself, even if it is an injury shared by a large class of other possible litigants.’ ” Easter v. Am. W. Fin., 381 F.3d 948, 961 (9th Cir. 2004) (quoting Warth v. Seldin, 422 U.S. 490, 501 (1975)).

B. 12(b)(2) Motion

A defendant can move to dismiss for lack of personal jurisdiction under Rule 12(b)(2). Fed. R. Civ. P. 12(b)(2). The party asserting the existence of jurisdiction bears the burden of establishing it. Mattel, Inc. v. Greiner & Hausser GmbH, 354 F.3d 857, 862 (9th Cir. 2003). If the court does not require an evidentiary hearing, a plaintiff “need only make a prima facie showing of the jurisdictional facts.” Boschetto v. Hansing, 539 F.3d 1011, 1015 (9th Cir. 2008) (internal quotation marks omitted). Uncontroverted allegations in the complaint must be taken as true. Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 800 (9th Cir. 2004).

To establish personal jurisdiction over a defendant, a plaintiff must show both that the long-arm statute of the forum state confers personal jurisdiction over an out-of-state defendant, and that the exercise of jurisdiction is consistent with federal due process requirements. Pebble Beach Co. v. Caddy, 453 F.3d 1151, 1154-55 (9th Cir. 2006). California's long-arm statute is coextensive with the scope of what is permitted by due process. Harris Rutsky & Co. Ins. Servs., Inc. v. Bell & Clements Ltd., 328 F.3d 1122, 1129 (9th Cir. 2003) (citing Cal. Civ. Proc. Code § 410.10). Constitutional due process requires that jurisdiction be exercised over a nonresident party only if that party has “minimum contacts” with the forum, such that the exercise of jurisdiction “does not offend traditional notions of fair play and substantial justice.” Int'l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945) (internal quotation marks omitted); accord Burger King Corp. v. Rudzewicz, 471 U.S. 462, 464 (1985).

“Even if a defendant has not had continuous and systematic contacts with the state sufficient to confer ‘general jurisdiction,’ a court may exercise ‘specific jurisdiction.’ ” Dole Food Co., Inc. v. Watts, 303 F.3d 1104, 1111 (9th Cir. 2002). Specific jurisdiction exists where the claim for relief arises directly from a defendant's contacts with the forum state. Am. Tel. & Tel. Co. v. Compagnie Bruxelles Lambert, 94 F.3d 586, 588 (9th Cir. 1996). For a court to exercise specific jurisdiction over a defendant:

(1) the non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privileges of conducting activities in the forum, thereby invoking the benefits and protections of its laws;

(2) the claim must be one which arises out of or relates to the defendant's forum-related activities; and

(3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable.

Picot v. Weston, 780 F.3d 1206, 1211 (9th Cir. 2015) (emphasis added). The plaintiff bears the burden of satisfying the first two prongs of this test. Schwarzenegger, 374 F.3d at 802. If the plaintiff is able to do so, the burden then shifts to the defendant to show why the exercise of personal jurisdiction would not be reasonable and fair under the third prong. Id.

“[W]here ․ a case sounds in tort,” the court is directed to “employ the purposeful direction test.” Axiom Foods, Inc. v. Acerchem Int'l, Inc., 874 F.3d 1064, 1069 (9th Cir. 2017). In tort cases, the Ninth Circuit requires a showing of purposeful direction, rather than purposeful availment. Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1228 (9th Cir. 2011). Purposeful direction is analyzed under the Calder “effects” test, which requires the defendant to have “(1) committed an intentional act, (2) expressly aimed at the forum state, [and] (3) causing harm that the defendant knows is likely to be suffered in the forum state.” Id. (citing Calder v. Jones, 465 U.S. 783, 789-90 (1984)).

C. 12(b)(6) Motion

Federal Rule of Civil Procedure 12(b)(6) allows a party to seek to dismiss a complaint for “failure to state a claim upon which relief can be granted.” “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ ” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. Labels, conclusions, and “formulaic recitation of a cause of action's elements” are insufficient. Twombly, 550 U.S. at 545.

The determination of whether a complaint satisfies the plausibility standard is a “context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679. Generally, a court must accept the factual allegations in the pleadings as true and view them in the light most favorable to the plaintiff. Soo Park v. Thompson, 851 F.3d 910, 918 (9th Cir. 2017); Lee, 250 F.3d at 679. But a court is “not bound to accept as true a legal conclusion couched as a factual allegation.” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 555).

As a general rule, leave to amend a dismissed complaint should be freely granted unless it is clear the complaint could not be saved by any amendment. Fed. R. Civ. P. 15(a); Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008).

III. Discussion

Truist argues that Garcia's complaint should be dismissed because: (1) Garcia lacks Article III standing because Garcia has not alleged a concrete harm; (2) the Court lacks personal jurisdiction because there is no general or specific jurisdiction over Truist in California; (3) the allegations do not provide sufficient notice under Rule 8; and (4) Garcia cannot state a claim for relief. See generally Motion. For the reasons discussed below, the Court finds that: (1) Garcia does have Article III standing; (2) there is personal jurisdiction; (3) Garcia's complaint satisfies Rule 8; and (4) Garcia has properly stated all claims.

A. Garcia does have Article III standing to pursue his claims.

Truist contends that Garcia has not sufficiently alleged a concrete harm to establish standing, because Garcia has not alleged what information he provided, what information of his was captured by Truist, whether he was aware of Truist's tracking, or if he believed he was de-anonymized by LinkedIn. See Motion at 6. Garcia contends that the violation of his privacy rights is actionable under the common law, the ECPA, and the CIPA, so there is a sufficiently concrete harm by the disclosure of his PII. See Opposition at 2 (first citing In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020); then citing Campbell v. Facebook, Inc., 951 F.3d 1106, 1117 (9th Cir. 2020)). And Garcia contends that he has specifically alleged what and how information was being intercepted to show a legally protected privacy interest. See id. at 3-4.

“[V]iolations of the right to privacy have long been actionable at common law.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020) (internal citations omitted). “Congress and the California legislature intended to protect these historical privacy rights when they passed the Wiretap Act, SCA, and CIPA,” which “codify a substantive right to privacy, the violation of which gives rise to a concrete injury sufficient to confer standing.” Id. (emphasis added). “Under California law, a legally recognizable privacy interest arises from the sort of information revealed.” Norman-Bloodsaw v. Lawrence Berkeley Lab'y, 135 F.3d 1260, 1271 n.17 (9th Cir. 1998). “Only those plaintiffs who have been concretely harmed by a defendant's statutory violation may sue that private defendant over that violation in federal court.” TransUnion, 594 U.S. at 427.

Here, the Court finds that Garcia has plausibly alleged a violation of privacy to show he has been “concretely harmed,” because Garcia reasonably alleges what PII was disclosed and captured by Truist to implicate a protectable privacy interest. Garcia alleges:

On or around May 2025, [the named] Plaintiff applied for a LightStream unsecured loan through the Website. During the application process, Defendant required Plaintiff to provide private information related to his citizenship, housing status, and employment information. Plaintiff applied for a loan through the Website using the same device and browser used to access his LinkedIn account. When creating his LinkedIn account, Plaintiff provided certain information to LinkedIn, including his full name. Unbeknownst to Plaintiff, Defendant disclosed his personally identifiable information (“PII”) to LinkedIn—including communications that contained Plaintiff's confidential, “nonpublic personal information” as defined by the GLBA and CalFIPA. Neither Defendant nor LinkedIn procured Plaintiff's prior consent to the sharing of his private and protected information.

Compl. ¶ 5. Here, Garcia thus alleges that he applied for a loan on Truist's website and shared information “related to his citizenship, housing status, and employment information.” Id. Garcia then describes how that information is shared by Truist to LinkedIn, see id. ¶¶ 56-70, and what sensitive information related to his citizenship, housing, and employment statuses can be shared, see id. ¶¶ 65-68. Accepting these allegations as true and viewing them in the light most favorable to Garcia, it is facially plausible and not hypothetical for the Court “to draw the reasonable inference[s]” that Truist disclosed Garcia's sensitive PII related to his citizenship, housing, and employment statuses to LinkedIn. See Iqbal, 556 U.S. at 678; see also Reply at 3-4. Accordingly, the Court finds that Garcia has alleged a concrete harm to establish standing.

Truist contends that Garcia does not specifically allege what Garcia's “actual experience using the Website” was. Reply at 4. But as discussed above, the Court can reasonably infer that Garcia's experience using the website was the same as that of any other loan applicant. See Compl. ¶¶ 5, 56-73. Next, Truist seems to contend that Garcia's complaint “include[d] no allegations plausibly linking these potential, generalized harms to the operation of [the defendant's] website vis-à-vis [the plaintiff].” See Reply at 3 (citing Popa, 153 F.4th at 791-92, 791 n.5). But unlike the plaintiff in Popa, where the plaintiff did not “explain how the tracking of her interactions with the PSP website caused her to experience any kind of harm that is remotely similar to the ‘highly offensive’ ․ disclosures that were actionable at common law,” Garcia has plausibly alleged the disclosure of his PII due to the operation of Truist's website via the LinkedIn Tag, which Truist “chose to embed,” and he has alleged the disclosure of information related to his citizenship and housing status, which can reasonably be viewed as “embarrassing, invasive, or otherwise private information,” see Popa, 153 F.4th at 791, 791 n.5; Compl. ¶¶ 5-6, 56-73, 137.

Accordingly, because Garcia does allege what PII of his was provided and disclosed to Truist, Garcia has sufficiently alleged facts to show a concrete violation of privacy to establish standing for his claims.²

B. The Court does have personal jurisdiction.

The parties do not dispute that there is no general jurisdiction over Truist in California. See Motion at 7-8; Opposition at 4-6; Reply at 4 n.3. And since this is a case that sounds in tort, the Court applies the purposeful direction test to analyze specific jurisdiction. Axiom Foods, 874 F.3d at 1069. The parties dispute the second and third prongs of the Calder “effects” test. See Mavrix Photo, 647 F.3d at 1228 (citing Calder, 465 U.S. at 789-90)).³ Truist contends that none of Truist's acts were “expressly aimed” at California, and Truist's actions did not cause harm that Truist would know was likely to be suffered in California. See Motion at 9-12. Garcia contends that Truist expressly aimed its Website at California, and it knew the harm it caused was likely to be suffered in California. See Opposition at 6-8. The Court finds that Garcia has shown purposeful direction under binding law and has satisfied the other requirements for specific jurisdiction.

i. Truist has expressly aimed its actions toward California and caused harm that it knew would be suffered in California.

First, the key case addressing the question of when a national website is expressly aimed at the forum state is Briskin v. Shopify, Inc., 135 F.4th 739 (9th Cir. 2025) (en banc). In Briskin, the Ninth Circuit expressly overruled the holding—set forth in AMA Multimedia, LLC v. Wanat, 970 F.3d 1201 (9th Cir. 2020)—that express aiming required a “forum-specific focus” or “differential targeting.” See Briskin, 135 F.4th at 757-58 (“AMA's rationale requiring a ‘forum-specific focus’ or ‘differential targeting,’ as the concept has been more recently described, is incorrect, and we now overrule it․ We now take this opportunity to overrule AMA and any other cases that require some sort of differential treatment of the forum state for a finding of ‘express aiming’ of the defendant's allegedly tortious conduct.”). In particular, the Ninth Circuit held: “[R]equiring differential targeting would have the perverse effect of allowing a corporation to direct its activities toward all 50 states yet to escape specific personal jurisdiction in each of those states for claims arising from or relating to their relevant contacts in the forum state that injure that state's residents.” See id. at 758. Therefore, “an interactive platform expressly aims its wrongful conduct toward a forum state when its contacts are its own choice and not random, isolated, or fortuitous, even if that platform cultivates a nationwide audience for commercial gain.” See id. at 758 (cleaned up) (quoting Ford Motor Co. v. Montana Eighth Jud. Dist. Ct., 592 U.S. 351, 359 (2021) (quoting Keeton v. Hustler Mag., Inc., 465 U.S. 770, 774 (1984))); Mavrix Photo, 647 F.3d at 1230).

Strangely, Truist relies almost exclusively on non-binding, district court cases that predate the Ninth Circuit's en banc opinion in Briskin. See Motion at 10-12. This is where its arguments fail.

In Briskin, the defendant was found to have purposely directed its conduct toward California because the defendant was “alleged to target California consumers to extract, collect, maintain, distribute, and exploit for its own profit,” where the defendant's “business model [was] to ․ obtain valuable personal data about California consumers for its own commercial gain.” Briskin, 135 F.4th at 755-56. The defendant “[knew] about its California consumer base, conduct[ed] its regular business in California, contact[ed] California residents, interact[ed] with them as an intermediary for its merchants, install[ed] its software onto their devices in California, and continue[d] to track their activities.” Id. at 759. The Ninth Circuit rejected the defendant's argument that the defendant's conduct was “mere happenstance arising from the California consumers' choice to do business with [the defendant],” because the defendant's “intentional activities constitute[d] express aiming toward California and its consumers to obtain and use their personal data for its own commercial gain.” Id. at 756.

The same factors are present here. Garcia plausibly alleges that Truist specifically targets California consumers “through [its] promotion, marketing, and operation of its services to residents within this District and throughout California,” and it “engages in this deceptive conduct for its own profit at the expense of its customers' privacy.” Compl. ¶¶ 8, 73. He also plausibly alleges that through its business model, Truist “provides a variety of financial services to Californians,” and that Truist knew of its California consumer base because “individuals must provide [their address] in order to open an account or apply for a financial product or service with Truist.” See id. ¶ 6. Furthermore, Truist profits from this information, as it can use it for targeted advertising. See id. ¶¶ 70, 73. Therefore, under the clear authority of Briskin, the Court finds that Truist has expressly aimed its intentional acts at California, thereby satisfying the second prong of the Calder effects test for purposeful direction.⁴

The Court next turns to the third prong—whether Truist caused harm that it knew would be likely to be suffered in California. See Mavrix Photo, Inc., 647 F.3d at 1228 (citing Calder, 465 U.S. at 789-90). Here, the Court finds the third prong is met. Garcia alleges that Truist disclosed its sensitive PII without consent, see Compl. ¶¶ 5-6, 56-73, 137, and that Truist knows of and targets California consumers and does business in California, see id. ¶¶ 5-6, 8, 73, so given California's privacy laws, Truist knew that its alleged disclosure of PII would harm California consumers. See Opposition at 8. Truist contends that because the only California connection is Garcia's claim, Garcia cannot show that Truist knew harm was likely to be suffered in California. See Reply at 8. But as discussed above, Garcia himself is not Truist's only California connection. Accordingly, the Court finds that Truist knew that its conduct would cause harm to California consumers.

ii. Garcia has met the other requirements for specific jurisdiction.

Truist contends that the other requirements for specific jurisdiction—that Garcia's claims arise out of or relate to acts that Truist purposefully directed toward California, and exercising specific jurisdiction would be reasonable under due process—are not met. But for the reasons discussed below, the Court finds that the other specific jurisdiction requirements are met.

First, Garcia's claims arise out of or relate to Truist's conduct with California. In Briskin, the Ninth Circuit held that the defendant's conduct arose out of or related to its conduct with the forum state, because it knew the plaintiff's device was in California, and the plaintiff “allege[d] the kind of injury that would ‘tend to be caused’ by [the defendant's] contacts with California merchants and consumers,” where the installation of the software that extracted the plaintiff's data was the kind of “contact that would tend to cause privacy injuries.” Briskin, 135 F.4th at 760 (quoting Yamashita v. LG Chem, Ltd., 62 F.4th 496, 505 (9th Cir. 2023)). Here, like the plaintiff in Briskin, Garcia has alleged that Truist knew about Garcia's and its California contacts' use of Truist's website to apply for a loan or other financial services, and Garcia's alleged injury of the interception of his PII by Truist is the kind of “contact that would tend to cause privacy injuries.” See Compl. ¶¶ 5-8, 54-74, 112, 115, 130. Accordingly, the Court finds Garcia's claims arise out of or relate to Truist's conduct with California.⁵

Next, exercising specific jurisdiction would not be unreasonable under due process. The Court applies seven factors:

(1) the extent of the defendant's purposeful interjection into the forum state's affairs; (2) the burden on the defendant of defending in the forum; (3) the extent of conflict with the sovereignty of the defendant's state; (4) the forum state's interest in adjudicating the dispute; (5) the most efficient judicial resolution of the controversy; (6) the importance of the forum to the plaintiff's interest in convenient and effective relief; and (7) the existence of an alternative forum.

Ayla, LLC v. Alya Skin Pty. Ltd., 11 F.4th 972, 984 (9th Cir. 2021) (quoting Freestream Aircraft (Berm.) Ltd. v. Aero L. Grp., 905 F.3d 597, 607 (9th Cir. 2018)). “No single factor is dispositive.” Silk v. Bond, 65 F.4th 445, 458 (9th Cir. 2023). Truist contends that because there is no purposeful direction, litigating in California would be burdensome, Truist is not a corporate citizen in California, there is no relationship with California besides Garcia's residency, witnesses and evidence would be outside California, and there is an alternative forum for this dispute, it would thus be unreasonable and violate due process to exercise specific jurisdiction in California. See Motion at 14-16.

Here, the Court finds it would not violate due process to exercise specific jurisdiction over Truist. First, as discussed above, Truist has purposefully directed its conduct towards California. Second, Truist operates business in California, see Compl. ¶¶ 5-6, so the Court does not find it to be burdensome to litigate in California. Also, Truist has not “ ‘presented evidence that the inconvenience is so great as to constitute a deprivation of due process,’ ” so the Court does not find this factor to weigh against specific jurisdiction. See Silk, 65 F.4th at 458 (quoting Freestream Aircraft (Berm.) Ltd., 905 F.3d at 608). Third, Truist does not cite to evidence showing a conflict between North Carolina and California law on Garcia's California-specific claims. Fourth, California has an interest in upholding its laws and ensuring a remedy for an injury. See Silk, 65 F.4th at 459 (noting that “California has an interest in providing an effective means of redress for its resident[s]”). Fifth, the fifth factor “is no longer weighed heavily given the modern advances in communication and transportation.” See id. at 459 (quoting Harris Rutsky & Co. Ins. Servs., 328 F.3d at 1133). And as to the last two factors, while there may be an alternative forum, two of the three of Garcia's claims are brought under California law, and Garcia is a resident and citizen of Los Angeles, so California is a convenient forum to him. Accordingly, when weighing all the factors, the Court does not find that the exercise of specific jurisdiction violates due process.

In sum, because the Court finds there is specific jurisdiction, Garcia has met his burden to establish personal jurisdiction over Truist.

C. Garcia's complaint provides sufficient notice under Rule 8.

Truist contends that Garcia “fails to allege that his own data—rather than theoretical or aggregated data—was improperly collected, disclosed, and used” to not give sufficient notice under Rule 8. See Motion at 16-17. Garcia contends that he has satisfied the pleading requirement under Rule 8. See Opposition at 12-13.

A pleading must contain “a short and plain statement of the claim showing that the pleader is entitled to relief ․” Fed. R. Civ. P. 8(a)(2). A complaint satisfies Rule 8 if it gives the defendant “fair notice of what the claim is ․ and the grounds upon which it rests.” Twombly, 550 U.S. at 555. A “party need not plead specific legal theories in the complaint, so long as the other side receives notice as to what is at issue in the case.” Sagana v. Tenorio, 384 F.3d 731, 736-37 (9th Cir. 2004).

Here, the Court finds that the Complaint gives Truist fair notice of what is alleged and the grounds on which Garcia is entitled to relief. As discussed above, Garcia has alleged with sufficient particularity what information was allegedly disclosed to Truist and then shared to LinkedIn, see Compl. ¶ 5, and Truist was on notice from Garcia's complaint that Garcia was alleging violations of the ECPA, CIPA, and invasion of privacy under the California constitution. See id. ¶¶ 29-73. Therefore, the Court finds that Garcia has satisfied the requirements of Rule 8.

D. Garcia has sufficiently stated a claim for an ECPA violation (Claim One) and claims for CIPA violations (Claims Two and Three).

Truist contends that Garcia's ECPA claim should be dismissed because it is a one-party consent statute, and the crime-tort exception does not apply. See Motion at 18-19. Truist also contends that Garcia cannot plead the elements of a violation of the ECPA or Sections 631 or 632 of the CIPA. See id. at 20-22. Garcia contends that the crime-tort exception does apply, see Opposition at 13-14, and that Garcia has sufficiently pleaded the elements of his ECPA and CIPA claims, see id. at 15-20. For the reasons discussed below, the Court finds that Garcia can state ECPA and CIPA claims.

i. The crime-tort exception of the ECPA applies, so Garcia can state an ECPA claim.

The parties do not dispute that the ECPA is a one-party consent statute, so the question is whether Garcia has sufficiently alleged that the crime-tort exception applies to Truist's conduct to state a claim. See Opposition at 13; Motion at 19. The exception applies if the “communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” 18 U.S.C. § 2511(2)(d).

Under Section 2511, “the focus is not upon whether the interception itself violated another law; it is upon whether the purpose for the interception—its intended use—was criminal or tortious.” Sussman v. Am. Broad. Companies, Inc., 186 F.3d 1200, 1202 (9th Cir. 1999) (emphasis added). The “purpose must be separate and independent from the act of [interception].” Planned Parenthood Fed'n of Am., Inc. v. Newman, 51 F.4th 1125, 1136 (9th Cir. 2022). “The [intercepting] party must also have the independent criminal or tortious purpose at the time the [interception] was made.” Id.

Here, the Court finds that Garcia has sufficiently alleged a tortious purpose to satisfy the exception. Garcia alleges that the purpose for the interception was to commit a tortious invasion of privacy: Truist “chose to embed the LinkedIn Insight Tag on its Website, which it owns and operates,” Compl. ¶¶ 6, 29 (emphasis added); and, with this tag, Truist then disclosed to LinkedIn sensitive and confidential information provided by consumers, see id. ¶¶ 3, 31, 42-44, 56-58. Therefore, when viewing the facts in Garcia's favor, the Court finds that Garcia has plausibly alleged that Truist's purpose was, at the very least, tortious, thereby satisfying the crime-tort exception.⁶ Sussman, 186 F.3d at 1202.

ii. Garcia has sufficiently alleged all the statutory elements of the ECPA and the CIPA.

To state an ECPA and CIPA claim, Garcia must allege: (1) an intentional act; (2) interception or eavesdropping; and (3) that the contents of a communication were intercepted or eavesdropped. See 18 U.S.C. § 2511; Cal. Penal Code §§ 631(a), 632(a) (emphasis added); see also United States v. Christensen, 828 F.3d 763, 791 n.10 (9th Cir. 2015) (quoting 18 U.S.C. § 2511(1)(a)) (“Section 2511 applies to anyone who ‘intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication.’ ”). Truist contends that Garcia as not properly stated a claim for violations of the ECPA or Sections 631 or 632 of the CIPA because he has failed to sufficiently allege: (1) an intentional act; (2) “interception or eavesdropping;” and (3) interception of the contents of a communication as opposed to record information. See Motion at 20-22; Reply at 14-15. Garcia contends that all elements are satisfied. See Opposition at 15-20.

First, the Court finds that Garcia has sufficiently alleged an intentional act, that is, “an act that is being done on purpose.” See Christensen, 828 F.3d at 775 (quoting S. Rep. No. 99–541, at 24 (1986)). “Thus, after [the] ECPA, the operative question under § 2511 is whether the defendant acted consciously and deliberately with the goal of intercepting wire communications.” Id.; see also Cal. Pen. Code §§ 631(a), 632(a).

Here, Garcia has alleged that Truist “integrated the LinkedIn Insight Tag wiretap into the Website to assist with its marketing efforts,” and “chose to embed the LinkedIn Insight Tag on its Website, which it owns and operates.” Compl. ¶¶ 6, 29. And a feature of the LinkedIn Tag “allows [it] to track users, even when third-party cookies are blocked.” Id. ¶ 41. With this tag, Truist then “discloses information provided by consumers on loan and credit card applications to LinkedIn,” which “include communications that contain sensitive and confidential information.” See id. ¶¶ 3, 31, 42-44, 56-58. Truist contends that Garcia cannot plead any intentional interception or eavesdropping and Garcia's allegations are conclusory. See Motion at 20; Reply at 15. But as discussed above, Garcia alleges that Truist chose to integrate and embed the LinkedIn Insight Tag on its Website, which allows the tracking of its users and disclosing of confidential information. See Compl. ¶¶ 6, 29, 41-44. So when viewing these allegations in Garcia's favor, the Court finds that Garcia has alleged an intentional act by Truist.

Second, the Court finds that Garcia has sufficiently alleged “interception or eavesdropping.” See Motion at 20-21; Opposition at 16-18. Truist argues that because Garcia voluntarily disclosed his personal information on the website and agreed to Truist's privacy policy, he cannot claim that his information was intercepted; it was merely shared in accordance with the policy. See Motion at 20. But Truist does not allege the contents of the privacy policy that Garcia agreed to for the sharing of his information, or that any sharing was consistent with the policy. See Opposition at 16-17; see also Compl. ¶ 27. Truist may seek to raise these arguments on summary judgment, but now—where the Court is limited to the four corners of the complaint—he has sufficiently alleged an interception or eavesdropping.

In addition, Truist argues that Garcia has failed to allege eavesdropping because he alleges that his information was disclosed to LinkedIn after he submitted it; it was not acquired during transmission. See Motion at 21-22. The Court finds that the allegations of the complaint support a reasonable inference that his communications were read while in transit. Garcia alleged that Truist “intercepted—in real time—[Garcia's] and Class Members' electronic communications via the tracking technology provided by LinkedIn on its website.” Compl. ¶ 95. Garcia then explained how the LinkedIn Tag works, where “[w]hen a user who has signed in to LinkedIn (even if the user subsequently logs out) is browsing a website where the LinkedIn Insight Tag has been embedded, an HTTP request is sent using cookies, which includes information about the user's actions on the website.” Id. ¶¶ 42-44. When viewing these allegations on how the LinkedIn Tag works together in combination with the Website, see id. ¶¶ 42-44, 60-69, it is plausible to infer that the interception happens in real time. Because the Court must accept the allegations as true and draw all reasonable inferences in Garcia's favor, the Court finds that Garcia has sufficiently stated that the disclosure of the communication happens in real-time transit, not after it has been sent. See Reply at 14-15.

Finally, Garcia has sufficiently alleged that what was intercepted or eavesdropped were the contents of his communications, not just the records of communication. The Wiretap Act defines “contents” as “information concerning the substance, purport, or meaning of that communication.” 18 U.S.C. § 2510(8). “Congress intended the word ‘contents’ to mean a person's intended message to another (i.e., the ‘essential part’ of the communication, the ‘meaning conveyed,’ and the ‘thing one intends to convey’).” In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014) (internal citations omitted). It “does not include record information regarding the characteristics of the message that is generated in the course of the communication,” like the name, address, or subscriber number or identity of a customer. Id.

Here, the complaint alleges that the LinkedIn Tag transmits to LinkedIn certain PII of every person who filled out a loan application. And as discussed above, Paragraph Five makes reasonably clear what concrete PII that was “related to [Garcia's] citizenship, housing status, and employment information” was disclosed. See Compl. ¶¶ 5, 65-68. Truist contends that there was no allegation directed at the contents of Garcia's communications because the browsers were communicating directly with the alleged eavesdropper, so there was no need for the eavesdropper to acquire such information. See Motion at 22 (quoting Cole v. Quest Diagnostics, Inc., No. 2:23-CV-20647, 2025 WL 88703, at *2 (D.N.J. Jan. 14, 2025), appeal dismissed, No. 25-1219, 2025 WL 2320331 (3d Cir. Feb. 28, 2025), and aff'd, No. 25-1449, 2025 WL 3172640 (3d Cir. Nov. 13, 2025)). But Truist does not rebut Garcia's allegations and explain why the communications intercepted were not content. See Opposition at 18-19; Reply at 15. Accordingly, the Court finds that Garcia has alleged the interception of the content of his communication.⁷

In sum, Garcia has stated a claim for an ECPA violation and claims for CIPA violations.

E. Garcia has stated a claim for invasion of privacy under the California Constitution (Claim Four).

Truist contends that because Garcia cannot allege facts to show what PII he provided, what PII of his was captured by Truist, and if he believed he was de-anonymized by LinkedIn, Garcia cannot allege an invasion of privacy. See Motion at 24-25. Garcia contends that because he has alleged the specific personal data at issue, he has alleged an invasion of a reasonable expectation of privacy that was egregious due to the disclosure of such information. See Opposition at 21-22.

To state a claim for invasion of privacy under the California constitution, “Plaintiffs must show that (1) they possess a legally protected privacy interest, (2) they maintain a reasonable expectation of privacy, and (3) the intrusion is ‘so serious ․ as to constitute an egregious breach of the social norms’ such that the breach is ‘highly offensive.’ ” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at 601. Just as the Court found that Garcia has standing to bring his suit for invasion of privacy, the Court finds that Garcia has stated a claim for an invasion of privacy under the California constitution. The Court analyzes the factors below.

To consider whether a plaintiff has stated a reasonable expectation of privacy, the court looks to whether the “defendant gained ‘unwanted access to data by electronic or other covert means, in violation of the law or social norms.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at 601-02 (quoting Hernandez v. Hillsides, Inc., 211 P.3d 1063, 1073 (Cal. 2009)). “To make this determination, courts consider a variety of factors, including the customs, practices, and circumstances surrounding a defendant's particular activities.” Id. at 602. Here, the Court finds that Garcia has plausibly alleged a reasonable expectation of privacy because Truist allegedly disclosed sensitive information, like information relating to a person's citizenship, housing status, and employment, to LinkedIn, but Garcia did not consent to such disclosure. See Compl. ¶¶ 2-5. Sharing information relating to citizenship particularly violates social norms. In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at 601-02 (quoting Hernandez, 211 P.3d at 1073)). And the nature of the alleged disclosure is important, because it was disclosed without consent using a hidden, embedded LinkedIn Tag on the Website. See Compl. ¶¶ 29, 47, 58-73. Thus, there was a reasonable expectation of privacy in the information disclosed.

Next, “[d]etermining whether a defendant's actions were ‘highly offensive to a reasonable person’ requires a holistic consideration of factors such as the likelihood of serious harm to the victim, the degree and setting of the intrusion, the intruder's motives and objectives, and whether countervailing interests or social norms render the intrusion inoffensive.” See In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at 606 (first citing Hernandez, 211 P.3d at 1073, and then citing Hill v. Nat'l Collegiate Athletic Assn., 865 P.2d 633, 647 (Cal. 1994)). Here, the Court finds that in today's society, releasing sensitive information, like a person's citizenship and employment status, is an “egregious breach of the social norms underlying the privacy right.” Hill, 865 P.2d at 655. Accordingly, Garcia has alleged how Truist's actions were “highly offensive to a reasonable person” to sufficiently state a claim for invasion of privacy under the California constitution.

IV. Conclusion

For the foregoing reasons, the Court hereby ORDERS as follows:

1. Truist's Motion to Dismiss (Dkt. No. 13) is DENIED; and

2. The Court will issue its Order Setting Scheduling Conference forthwith.

IT IS SO ORDERED.

FOOTNOTES

2.   Garcia contends that “as the browser and device are the same, as alleged [in their Complaint], the interceptions occurred.” See Opposition at 4 (citing Compl. ¶¶ 5, 42). Truist does not rebut this argument in its Reply, so it is conceded. See Reply at 3-4.

3.   The parties do not dispute whether Truist committed an intentional act, the first prong of the “effects” test. See Motion at 8; Opposition at 5. Thus, the Court analyzes the second and third prongs of the “effects” test.

4.   The facts of this case are entirely distinguishable from those in Rounds v. Case-Mate Inc., No. 2:24-CV-08531, 2025 WL 1873999, at *7 (C.D. Cal. July 2, 2025), relied upon by Truist. In that case, the defendant was not a national company and there were no allegations that the defendant cultivated or exploited a nationwide audience for commercial gain. The facts here appear to be more akin to those in Thomas v. Papa John's Int'l, Inc., No. 24-3557, 2025 WL 1704437, at *1 (9th Cir. June 18, 2025), where the allegations were that the defendant operated a website with a national viewership and scope that appealed to and profited from a California audience.

5.   Truist cites to Rounds v. Case-Mate Inc., No. 2:24-CV-08531, 2025 WL 1873999, at *7 (C.D. Cal. July 2, 2025), to argue why Garcia's claims do not arise out of relate to Truist's California conduct. See Reply at 10. However, Rounds is non-binding authority, and either way it is distinguishable. Unlike the plaintiff in Rounds, who did not allege that their “injury either has a connection to or was caused by [the defendant's] selling and shipping products to California,” Garcia has alleged that his injury was caused by Truist's conduct with California, because Truist knew Garcia and California consumers applied for its financial services through its website and had the LinkedIn Tag on its website. See Rounds v. Case-Mate Inc., No. 2:24-CV-08531-WLH-RAO, 2025 WL 1873999, at *7 (C.D. Cal. July 2, 2025); see also Compl. ¶¶ 6-8, 54-74, 112, 115, 130. So as discussed above, the Court finds that the “arise out or relate to” prong is met.

6.   The Court need not reach the question of whether the Complaint contains allegations that would support the crime set forth in the Gramm-Leach-Bliley Act, 15 U.S.C. § 6823, as asserted by Garcia.

7.   Truist contends that Garcia alleges that Truist divulged the information to itself or that his browser was communicating directly with Truist, the alleged eavesdropper, so there could be no eavesdropping. See Motion at 22; Reply at 15 (citing In re Google Inc. Cookie Placement Consumer Privacy Litig., 806 F.3d 125, 140-41 (3d Cir. 2015)). But Truist's case cited for support was rejected by the Ninth Circuit, where the Ninth Circuit held that “simultaneous, unknown duplication and communication of GET requests do not exempt a defendant from liability under the party exception,” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 607-08 (9th Cir. 2020). Thus, Truist's conclusion, whether true or not, is wrong. See Opposition at 19.

MAAME EWUSI-MENSAH FRIMPONG United States District Judge